ISO/TC 8/WG 4 - Maritime security

This document establishes the elements of onboard cyber risk assessment and specifies requirements for the assessment process, assessment preparation, risk identification, risk analysis and risk evaluation. This document applies to the risk assessment of onboard cyber systems based on network technologies which mainly include bridge systems, cargo management systems, propulsion and machinery management and power control systems, access control systems, passenger or visitor servicing and management systems, passenger-facing networks, core infrastructure systems, administrative and crew welfare systems and communication systems.

This document gives requirements and recommendations for establishing, implementing, maintaining and continually improving a cyber risk assessment system within the context of a company’s security management system (SMS). All the elements for compliance with this document can therefore be traceable within the SMS by direct inclusion or reference.

ISO 28007-1:2015 gives guidelines containing additional sector-specific recommendations, which companies (organizations) who comply with ISO 28000 can implement to demonstrate that they provide Privately Contracted Armed Security Personnel (PCASP) on board ships.